Heads up -- a new name in job scams is on the radar for December: "Impex Consult Financial Consulting Group". This appears to be the same job scam gang responsible for Athens Financial Group Ltd, based on their common use of name server hosts. As usual, they want you to be a financial middle man -- or mule -- for stolen funds. This one is quite active: I've seen three different domain names covering the same scam in the past few days.
Looking to make a little extra money this Christmas season? If so, then I suggest you steer well clear of Viking Finance Ltd, which is the latest name in use by the money mule recruiters who called themselves Athens Financial Group Ltd last month, and a long string of other names in months prior to that. Remember folks, money mules participate in crimes, and crime is bad!
Dubious congratulations are in order for the new ".mobi" top-level domain name: they're now officially being used by job scammers. The Athens Financial Group job scam now includes the "afgl.mobi" domain as part of the scam. This top-level domain is intended for websites which are optimised for mobile devices, but our pet scammers are just using it as yet another name in their efforts to be a moving target: the website behind the name is the same old same old.
If past experience is anything to go by, we can expect quite a few job offers from Norden United Ltd this month. They will look suspiciously similar to all the other job offers I've reported here recently, and all be illegal money mule jobs. The first of these arrived a couple of days ago, and I would have reported it sooner, but I had a backlog of work to clear.
It looks for all the world like the same old phishing/jobscam gang that did Israeli Brokerage Services and goodness knows how many other scams reported here, but the new name of the month is "Athens Financial Group Ltd". Go take a peek if you want the details, but it really is the same old scam with a new name.
The "Israeli Brokerage Services Ltd" money mule job scam is a continuation of others we've seen here previously, and also related to the "Bronsard Advantage" one reported a here recently. I mention it here specifically because the spammers are now trying a new tactic: leaving out the hyperlink to their website. In the most recent instance of this spam, the instructions are, "to take a visit to our web site please enter in address line in your Internet browser." The URL in question is http://ibsl.org. At a guess, their motive is to avoid spam filters, and it worked to some degree. This particular spam was tagged as "suspected spam" by one filter, then forwarded to a Gmail account which correctly classified it as spam.
Note that because the spam text is presented in a GIF image, the recipient really does have to type the address by hand -- a kind of CAPTCHA, really.
First sighting: "Bronsard Advantage Co" money mule job scam. This has the same modus operandi and basic pattern as many other job scams reported here. For details of the operation follow the above link; this blog entry serves only as an announcement of first sighting.
All original material of whatever nature appearing in this blog under the authorship of "Spotter" (abbr. of "Deception Spotter") is dedicated to the Public Domain. Note that portions of a work enclosed in "blockquote" tags are, in general, quotations to which this dedication can not apply. (Rationale)
